AWS Transfer Family访问S3加密bucket

S3启用了Server-side encryption (SSE-KMS)

使用rclone 访问aws transfer上挂在的S3 下载或者上传文件时提示permission denied

这时需要在AWS Transfer Family上设置KMS支持

transfer family的role更新如下policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::bucket-name"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion"
            ],
            "Resource": "arn:aws:s3:::bucket-name/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:region:aws-account:key/ID"
        }
    ]
}

需要注意的是，完成后，要更新transfer family的用户policy，因为默认会缓存着旧版的policy，因为需要打开对应user，刷新重新添加policy